Virtual Machine Isolation for Virus Detection in Electronic Messages
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virus detection mechanisms are ineffective in accurately identifying malicious behavior in electronic messages, particularly new viruses, as they rely on known system call patterns and may generate false positives, and do not account for the intended destination environment, leading to potential harm and propagation.
Innovation Solution
Executing electronic message code in a contained virtual machine environment that emulates the intended destination environment, using configuration information specific to the target system, to accurately detect virus-like behavior and prevent propagation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If virus detection relies on known system call patterns, then detection speed is improved, but detection accuracy deteriorates due to false positives and inability to detect new viruses
Solution Approach 1:
The patent creates a virtual machine environment that copies the destination system's configuration, applications, and operating environment to accurately replicate how code would execute in its intended target. This virtual copy allows observation of actual viral behavior without affecting real systems, enabling both speed and accuracy by executing code in a faithful replica rather than relying on pattern matching.
Solution Approach 2:
The system changes the detection approach from static pattern matching to dynamic execution observation. By modifying the state of the virtual machine to match the destination environment's configuration, applications, and OS version, the system can detect viruses based on their actual behavior in a replicated environment rather than relying on pre-defined call patterns, thus improving accuracy while maintaining speed.
2Measurement precision
If code execution is performed in the intended destination environment, then detection accuracy is improved, but system complexity increases due to environment emulation requirements
Solution Approach 1:
Instead of building complex emulation frameworks, the patent uses virtual machine technology to create accurate copies of destination environments. The virtual machine captures and replicates the destination system's configuration, installed applications, and operating environment parameters, providing faithful execution context without requiring complex custom emulation code. This approach achieves high accuracy while managing complexity through established virtualization technology.
3Object-affected harmful factors
If all executable code is blocked, then virus propagation is prevented, but legitimate functionality is lost due to false positives
Solution Approach 1:
The system creates a virtual copy of the destination environment to safely execute and observe code behavior. By running the executable in this isolated virtual replica rather than blocking it outright, the system can observe whether the code exhibits viral behavior in a context that mirrors the actual destination. This allows legitimate code to pass through while only blocking code that demonstrates harmful behavior in the virtual environment.
Solution Approach 2:
The virtual machine execution provides feedback about the code's actual behavior in a replicated environment. The system observes system calls, file access patterns, and other execution characteristics to determine whether the code is malicious. This feedback mechanism enables intelligent decision-making about whether to block the code, reducing false positives while preventing actual viruses from propagating.
Data Source
AI summary
An intermediary isolation server receives electronic messages and isolates any viral behavior from harming its intended destination. After the intermediary receives an electronic message, it determines that the electronic message has associated executable code, and then identifies the environment in which the electronic message code would be executed if delivered. The intermediary then executes the code by emulating how it would be executed in its ultimate environment. If a viral-like behavior is detected, appropriate action is taken to prevent the execution of the code at its intended destination. The attachment is executed in a contained environment that allows for the contained environment to be easily restarted in a clean state.